GoKawiilChinese-language group hijacks Brazilian government servers for phishing network
Security researchers found that a Chinese-speaking threat actor has compromised Brazilian government and education websites, using them as a reverse-proxy network to funnel traffic to gambling-themed phishing sites. The attackers exploit the trust and infrastructure of official domains to disguise malicious traffic and evade detection.
GoKawiil's interpretation of the reporting above, not reported fact.
Abusing government infrastructure gives attackers credibility and resilience, since traffic routed through .gov domains is less likely to be blocked or flagged by security tools. This case highlights how weak security hygiene at public institutions can be weaponized at scale for financial fraud far beyond the original target.
- Attackers compromised Brazilian government and education sites to build a reverse-proxy network
- The network directs users to gambling-themed phishing pages
- Abusing trusted government domains helps attackers bypass security filters and detection
Source: darkreading.com, 2026-09-08
Published there as: “Cybercriminals Hack Brazilian Government Servers to Host Phishing Sites”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.